tcpdump

tcpdump [options] [expression]

System administration command. Dump headers and packets of network traffic that match expression. The command continues to capture packets until it receives a SIGTERM or SIGINT signal (usually generated by typing the interrupt character control-C). When finished, it will generate a report on traffic captured, received, or dropped by the kernel.

Expressions

Create matching expressions using the following primitives followed by an ID or name.

direction

A qualifier indicating whether to match source or destination information. Accepted values are src, dst, srcordst, and srcanddst. When not specified, the expression will match either source or destination traffic.

A qualifier indicating what kind of thing the ID or name references, such as a part of a hostname (host), IP address (net) or port (port). When not specified, the match defaults to host.

Options

-A

Print packets in ASCII text.

-cn

Exit after receiving n packets.

-Cn

When saving to a file, do not write files larger than n million bytes. Open a new file with the same basename appended by a number. Start with the number 1.

-d, -dd, -ddd

Compile and dump the packet-matching code for the given expression, then exit. Use the second form to dump it as a C programming fragment. Use the third form to dump the code in decimal.

-D

Print a list of the available interfaces, then exit.

-e

Print the link-level header on each line.

-Ffile

Read expression from the specified file.

-iinterface

Listen on the specified interface. If not specified, tcpdump will listen on the lowest-numbered interface available, other than the loopback interface. Use any to listen to all available interfaces.

-l

Line buffer standard out.

-L

Print the data link types for an interface, then exit.

-n, -nn

Print IP addresses instead of converting them to hostnames. Use the second form to leave protocols and port numbers in numeric form, as well.

-N

Print hostnames instead of fully qualified domain names.

-q

Abbreviate output, printing less protocol information.

-rfile

Read packets from the specified file. (You can create such a file with the -w option.)

-sn

Read n bytes of data from each packet. (The default is 68.)

-S

Print absolute TCP sequence numbers.

-Tn

Read n bytes of data from each packet. (The default is 68.)

-t, -tt, -ttt, -tttt

Change display of timestamp. Use the first form to omit the timestamp from each line. Use the second form to print an unformatted timestamp. Use the third form to print the time in seconds between the current and the previous dump line. The final form prints the date before the timestamp on each dump line.

-u

Print undecoded NFS handles.

-v, -vv, -vvv

Increase the verbosity of the printout. Each additional v increases the detail of the information printed.

-wfile

Write the raw packet information to file without parsing or printing it. Specify - to write to standard output.

-x,-xx

Print packets in hex. Use the second form to print the packet's link level header in hex as well.

-X,-XX

Print packets in hex and ASCII text. Use the second form to print the packet's link level header in hex and ASCII as well.

-Zuser

Drop root privileges and change to the specified user. Use the primary group of the specified user.

Examples

Place full packets into a file named tcpdump.cap for later analysis:

tcpdump -v -w tcpdump.cap -xX -s 0

Read all packet headers received on the eth0 interface, except for arp and SSH packets: